Unknown Keystore / Encrypted Wallet Format

Question

Have a user with a keyfile format that I don't recognize and MEW can't decrypt (obviously). Anyone have any insight on where this came from or what the encryption mechanism is? Sensitive info has been removed:

"encryptedKey": {
  "iv": "somedata",
  "v": 1,
  "iter": 1000,
  "ks": 128,
  "ts": 64,
  "mode": "ccm",
  "adata": "",
  "cipher": "aes",
  "salt": "somedata",
  "ct": "somedata"
}

Answer 1

I think this is a Bitgo privatekey backup format. I've created already a bitcoin account with Bitcold i've got after backuping my key a similar file:

{"iv":"0fSuBvpAJG36OEGHC59VEg==","v":1,"iter":10000,"ks":256,"ts":64,"mode"
:"ccm","adata":"","cipher":"aes","salt":"hE44Rh**fBI=","ct":"XPU**7nMb/rW
4jDeUAstbutIJxKKleh3XZ+ThTMnIj52ilQYMza3D3DNS6YnngplUl3/**Bj
ipFmpQVqWUSnuQ2786ySCkaNw2wgjc7yRY7MonYdeDFtvNzTJX4GLpgS/Kg**="}

Bitgo proposes an ethereum wallet called www.ether.li (multisig wallet) and they use the same previous format :

{"iv":"/TWPASFYuO**P5Q==", "v":1, "iter":1000, "ks":128, "ts":64, "mode":"ccm", "adata":"", "cipher":"aes", "salt":"Udg***Ckg=", "ct":"1MsES**vhp4X**FiFTyup2**8Fw1lsDA***pMigSo8/R**/iOaVdCYbjAaT04Y7****"}

in their Api there is a function to decrypt the key:

var encryptedString = '{"iv":"n4zHXVTi/Go/riCP8fNs/A==","v":1,"iter":10000,"ks":256,"ts":64,"mode":"ccm","adata":"","cipher":"aes","salt":"zvLyve+4AJU=","ct":"gNMqheicMoD8ZmNzRwuQfWGAh+HA933l"}';
var decryptedString = bitgo.decrypt({ password: "password", input: encryptedString });